rea-agents 6.2.0 → 6.3.0

package/dist/contracts/inputSchemaPresentation.js

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from "node:util";
 const schemaMaps = new Set([
     "$defs",
     "definitions",
@@ -83,8 +84,98 @@ const describeSchema = (schema, root, describeProperty) => {
         return [key, value];
     }));
 };
-/** Describe canonical input fields without changing structural constraints. */
+const objectBranch = (root, branch) => {
+    // Reference siblings evaluate separately from the target in 2020-12, so a
+    // merged object could accept inputs the branch rejects.
+    const resolved = isObject(branch) && typeof branch.$ref === "string"
+        ? Object.keys(branch).length === 1
+            ? resolveReference(root, branch.$ref)
+            : undefined
+        : branch;
+    return isObject(resolved) &&
+        resolved.type === "object" &&
+        isObject(resolved.properties)
+        ? resolved
+        : undefined;
+};
+const requiredProperties = (branch) => Array.isArray(branch.required)
+    ? branch.required.filter((name) => typeof name === "string")
+    : [];
+const sharedRequiredProperties = (branches) => {
+    const [first = [], ...others] = branches.map(requiredProperties);
+    return first.filter((name) => others.every((names) => names.includes(name)));
+};
+const inputGroup = (branch) => {
+    const required = requiredProperties(branch);
+    const optional = Object.keys(branch.properties ?? {})
+        .filter((name) => !required.includes(name))
+        .map((name) => `[${name}]`);
+    return [...required, ...optional].join(" + ");
+};
+// Anthropic tool input schemas reject anyOf, oneOf, and allOf at the root, and
+// clients then drop the tool or advertise it without parameters. Present a
+// root union of strict object groups as one object whose properties are the
+// union of the groups. The canonical Zod schema still enforces the exact group.
+const flattenRootObjectUnion = (root) => {
+    const { anyOf, oneOf, ...rest } = root;
+    const alternatives = Array.isArray(anyOf) ? anyOf : oneOf;
+    if (!Array.isArray(alternatives) ||
+        alternatives.length === 0 ||
+        root.properties !== undefined)
+        return root;
+    const branches = alternatives.map((branch) => objectBranch(root, branch));
+    if (!branches.every((branch) => branch !== undefined))
+        return root;
+    const variants = new Map();
+    for (const branch of branches)
+        for (const [name, schema] of Object.entries(branch.properties ?? {})) {
+            const known = variants.get(name) ?? [];
+            if (!known.some((seen) => isDeepStrictEqual(seen, schema)))
+                known.push(schema);
+            variants.set(name, known);
+        }
+    const required = sharedRequiredProperties(branches);
+    // A field unique to a group still needs that group's required partners.
+    // Counting properties alone would let optional fields pad an incomplete pair.
+    const dependencies = Object.fromEntries([...variants.keys()].flatMap((name) => {
+        const owners = branches.filter((branch) => Object.hasOwn(branch.properties ?? {}, name));
+        const partners = sharedRequiredProperties(owners).filter((partner) => partner !== name && !required.includes(partner));
+        return partners.length > 0 ? [[name, partners]] : [];
+    }));
+    const fewestRequired = Math.min(...branches.map((branch) => requiredProperties(branch).length));
+    // Groups that differ only in property values add no caller guidance.
+    const groups = [...new Set(branches.map(inputGroup))];
+    const description = [
+        typeof rest.description === "string" ? rest.description : undefined,
+        groups.length > 1
+            ? `Provide a complete input group: ${groups.join("; ")}.`
+            : undefined,
+    ].filter((text) => text !== undefined);
+    return {
+        ...rest,
+        type: "object",
+        ...(description.length > 0 ? { description: description.join(" ") } : {}),
+        properties: Object.fromEntries([...variants].map(([name, schemas]) => [
+            name,
+            schemas.length === 1 ? schemas[0] : { anyOf: schemas },
+        ])),
+        ...(required.length > 0 ? { required } : {}),
+        ...(fewestRequired > 0 ? { minProperties: fewestRequired } : {}),
+        ...(Object.keys(dependencies).length > 0
+            ? {
+                [root.$schema === "http://json-schema.org/draft-07/schema#"
+                    ? "dependencies"
+                    : "dependentRequired"]: dependencies,
+            }
+            : {}),
+        ...(branches.every((branch) => branch.additionalProperties === false)
+            ? { additionalProperties: false }
+            : {}),
+    };
+};
+/** Describe canonical input fields and present the root as one object. */
 export const presentInputJsonSchema = (root, describeProperty) => {
-    const described = describeSchema(root, root, describeProperty);
-    return isObject(described) ? described : root;
+    const flattened = flattenRootObjectUnion(root);
+    const described = describeSchema(flattened, flattened, describeProperty);
+    return isObject(described) ? described : flattened;
 };

package/dist/contracts/javascript/electronToolContracts.js

@@ -54,7 +54,7 @@ export const ELECTRON_TOOL_CONTRACTS = [
     {
         name: "analyze_javascript_application",
         ...toolContractMetadata("analyze_javascript_application"),
-        description: "Reconstruct one local ASAR or extracted JavaScript application as an inline application graph without executing it. Returns all recovered graph nodes, edges, semantic relations, limitations, and coverage.",
+        description: "Reconstruct one local ASAR or extracted JavaScript application as an inline application graph without executing it. Returns recovered graph nodes, edges, semantic relations, integrity contradictions, limitations, and coverage. Integrity mismatches fail by default; record-and-continue retains observed bytes as untrusted and marks graph coverage partial.",
         kind: "electron-provider",
         inputSchema: analyzeJavaScriptApplicationInputSchema,
         outputSchema: applicationOutputSchema,
@@ -64,6 +64,7 @@ export const ELECTRON_TOOL_CONTRACTS = [
                 input: {
                     input_path: "/Applications/Example.app/Contents/Resources/app.asar",
                     format: "auto",
+                    integrity_policy: "fail",
                 },
             },
         ],

package/dist/contracts/javascript/javascriptApplicationWorkflowExamples.js

@@ -1,8 +1,9 @@
 import { createEvidence } from "../../domain/evidence.js";
-import { reconcileJavaScriptRuntime } from "../../domain/javascript/javascriptRuntimeReconciliation.js";
+import { parseRuntimeReconciliationInput, reconcileJavaScriptRuntime, } from "../../domain/javascript/javascriptRuntimeReconciliation.js";
 import { JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE, JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE, } from "./javascriptRuntimeReconciliationExample.js";
 import { createHistoricalSourceGraph } from "../../domain/referenceSourceGraph.js";
-const reconciliation = reconcileJavaScriptRuntime(JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE);
+import { reconcileJavaScriptRuntimeInputSchema } from "../../domain/javascript/javascriptRuntimeReconciliationSchemas.js";
+const reconciliation = reconcileJavaScriptRuntime(parseRuntimeReconciliationInput(reconcileJavaScriptRuntimeInputSchema.parse(JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE)));
 const reconciliationEvidence = createEvidence(undefined, {
     id: "rea-javascript-runtime-reconciliation",
     name: "REA JavaScript runtime reconciliation",

package/dist/contracts/javascript/javascriptExportShapeComparisonExample.js

@@ -4,7 +4,7 @@ import { analyzeJavaScriptSemantics } from "../../domain/javascript/javascriptSe
 import { projectJavaScriptExportReturnShapes } from "../../domain/javascript/javascriptExportReturnShapeProjection.js";
 import { completeApplicationCoverage, partialApplicationCoverage, } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
 import { createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "../../domain/javascript/javascriptApplicationGraph.js";
-import { createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, } from "../../domain/javascript/javascriptSemanticGraph.js";
+import { createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, JavaScriptSemanticEvidenceContextRegistry, } from "../../domain/javascript/javascriptSemanticGraph.js";
 import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES } from "../../domain/javascript/javascriptSemanticGraphSchemas.js";
 import { javascriptApplicationAnalysisResultSchema } from "../../domain/javascript/javascriptApplicationAnalysis.js";
 // Inventory identities/counters captured from real analysis of these two sources.
@@ -15,12 +15,14 @@ const captures = {
         root_artifact_sha256: "5005ebc2f35719a2fc014f19a81c669f3a1ab471b7245ef6985a111b6845a747",
         inventory_manifest_id: "agm_f30ded9a83d43a3980417bbe63dfad569e83386f243c4d6a01af0166372cb9e6",
         inventory_graph_sha256: "4b8aceaf67e43fd8317ec1f5fd1df5235f8fa402335accf011683e008c6bc62c",
+        integrity_contradictions: [],
     },
     total: {
         input_path: "/examples/javascript-export-presence/right",
         root_artifact_sha256: "269ae72a601ad5ac02f1c2dda6ff9accffa2d2e4f4a9e406facee0d5a78a5377",
         inventory_manifest_id: "agm_d3ceaa1af38fb3474070ca25c0d4644282e5fb7d5824cee3e3a81391481e9fc1",
         inventory_graph_sha256: "3e9bc926951480c35385efe5650d9d781631bd74c37a523d543b5fbe06b01ce6",
+        integrity_contradictions: [],
     },
 };
 const summary = {
@@ -56,7 +58,6 @@ const statistics = {
     findings: 1,
     modules: 0,
     parse_failures: 0,
-    truncated_scopes: 0,
 };
 const modulePath = "parser.mjs";
 const limitations = [
@@ -163,6 +164,7 @@ const exampleEvidence = (property) => {
         coverage: partialApplicationCoverage([], null),
         limitations,
     });
+    const evidenceContexts = new JavaScriptSemanticEvidenceContextRegistry();
     const module = createJavaScriptSemanticGraphNode({
         kind: "module",
         identity: {
@@ -181,12 +183,13 @@ const exampleEvidence = (property) => {
             state: "observed",
             confidence: "exact",
         },
-    });
+    }, evidenceContexts);
     const semanticGraph = createJavaScriptSemanticGraph({
         schema: "JavaScriptSemanticRelationGraph",
         root_artifact_sha256: metadata.root_artifact_sha256,
         application_graph_id: graph.graph_id,
         root_node_ids: [module.node_id],
+        evidence_contexts: evidenceContexts.contexts,
         nodes: [module],
         relations: [],
         fingerprints: [],

package/dist/contracts/javascript/javascriptRuntimeReconciliationExample.js

@@ -1,7 +1,7 @@
 import { createEvidence } from "../../domain/evidence.js";
 import { createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "../../domain/javascript/javascriptApplicationGraph.js";
 import { createWebTextArtifact } from "../../domain/webContentArtifact.js";
-import { createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, } from "../../domain/javascript/javascriptSemanticGraph.js";
+import { createJavaScriptSemanticGraph, createJavaScriptSemanticGraphNode, JavaScriptSemanticEvidenceContextRegistry, } from "../../domain/javascript/javascriptSemanticGraph.js";
 import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES } from "../../domain/javascript/javascriptSemanticGraphSchemas.js";
 const applicationSha256 = "1".repeat(64);
 const script = createWebTextArtifact("export const example = true;\n", "text/javascript");
@@ -59,6 +59,7 @@ const graph = createJavaScriptApplicationGraph({
     coverage: completeCoverage,
     limitations: [],
 });
+const evidenceContexts = new JavaScriptSemanticEvidenceContextRegistry();
 const semanticNode = createJavaScriptSemanticGraphNode({
     kind: "module",
     identity: {
@@ -72,12 +73,13 @@ const semanticNode = createJavaScriptSemanticGraphNode({
     label: "renderer.js",
     properties: {},
     evidence: graphEvidence,
-});
+}, evidenceContexts);
 const semanticGraph = createJavaScriptSemanticGraph({
     schema: "JavaScriptSemanticRelationGraph",
     root_artifact_sha256: applicationSha256,
     application_graph_id: graph.graph_id,
     root_node_ids: [semanticNode.node_id],
+    evidence_contexts: evidenceContexts.contexts,
     nodes: [semanticNode],
     relations: [],
     fingerprints: [],
@@ -98,7 +100,8 @@ const semanticGraph = createJavaScriptSemanticGraph({
     },
     limitations: ["Semantic relations are unavailable in this minimal example."],
 });
-const staticEvidence = createEvidence({ path: inputPath, sha256: applicationSha256, format: "directory" }, {
+/** Minimal valid static application Evidence for graph workflow examples. */
+export const JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE = createEvidence({ path: inputPath, sha256: applicationSha256, format: "directory" }, {
     id: "rea-javascript-application",
     name: "REA JavaScript application analyzer",
     version: "1",
@@ -112,6 +115,7 @@ const staticEvidence = createEvidence({ path: inputPath, sha256: applicationSha2
         root_artifact_sha256: applicationSha256,
         inventory_manifest_id: `agm_${"2".repeat(64)}`,
         inventory_graph_sha256: "3".repeat(64),
+        integrity_contradictions: [],
         graph,
         semantic_graph: semanticGraph,
         summary: {
@@ -147,15 +151,12 @@ const staticEvidence = createEvidence({ path: inputPath, sha256: applicationSha2
             findings: 0,
             modules: 0,
             parse_failures: 0,
-            truncated_scopes: 0,
         },
         limitations: [],
     },
     confidence: "derived",
     authority: "shipped-artifact",
 });
-/** Minimal valid static application Evidence for graph workflow examples. */
-export const JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE = staticEvidence;
 const runtimeEvidence = createEvidence(undefined, {
     id: "rea-cdp-electron",
     name: "REA Electron file-page CDP observation provider",
@@ -215,7 +216,7 @@ const runtimeEvidence = createEvidence(undefined, {
 });
 /** Compact valid Evidence pair used by the public reconciliation contract. */
 export const JAVASCRIPT_RUNTIME_RECONCILIATION_EXAMPLE = {
-    static_layers: [{ analysis: staticEvidence }],
+    static_layers: [{ analysis: JAVASCRIPT_APPLICATION_EVIDENCE_EXAMPLE }],
     runtime_observations: [runtimeEvidence],
 };
 function browserCompleteness() {

package/dist/contracts/managed/managedToolContracts.js

@@ -1,12 +1,13 @@
 import { z } from "zod";
+import { isAbsolute } from "node:path";
 import { managedOutputSchemas } from "../toolOutputSchemaGroups.js";
 import { toolContractMetadata } from "../toolEffects.js";
 import { requireOutputSchema } from "../toolOutputSchemaPrimitives.js";
-import { isAbsoluteLocalPath, localPathStringSchema, } from "../../domain/localPath.js";
+import { localPathStringSchema } from "../../domain/localPath.js";
 /** Exact caller boundary for execution-free PE/CLI triage and identity. */
 export const managedTargetInputSchema = z.strictObject({
     path: localPathStringSchema
-        .refine(isAbsoluteLocalPath, {
+        .refine(isAbsolute, {
         message: "path must be an absolute local filesystem path (for example /tmp/Example.dll or C:\\Example.dll)",
     })
         .describe("Explicit absolute managed PE/CLI path; omit to reuse the previously selected managed target")

package/dist/contracts/mobileApplicationGraphExamples.js

@@ -1,10 +1,10 @@
-import { canonicalDigest } from "../domain/comparisonSemantics.js";
+import { digestCanonicalValue } from "../domain/canonicalDigest.js";
 import { createEvidence } from "../domain/evidence.js";
 import { jsonValueSchema } from "../domain/jsonValue.js";
 const inventory = (format, digit) => {
     const sha = digit.repeat(64);
-    const artifactId = `art_${canonicalDigest({ sha256: sha }, "Artifact inventory")}`;
-    const occurrenceId = `occ_${canonicalDigest({ root: artifactId }, "Artifact inventory")}`;
+    const artifactId = `art_${digestCanonicalValue({ sha256: sha }, "Artifact inventory")}`;
+    const occurrenceId = `occ_${digestCanonicalValue({ root: artifactId }, "Artifact inventory")}`;
     const nodes = [
         {
             artifact_id: artifactId,
@@ -35,7 +35,7 @@ const inventory = (format, digit) => {
             limitations: [],
         },
     ];
-    const graphSha256 = canonicalDigest({
+    const graphSha256 = digestCanonicalValue({
         nodes,
         occurrences,
         edges: [],
@@ -43,7 +43,7 @@ const inventory = (format, digit) => {
     }, "Artifact inventory");
     return jsonValueSchema.parse({
         manifest: {
-            manifest_id: `agm_${canonicalDigest({
+            manifest_id: `agm_${digestCanonicalValue({
                 root_artifact_id: artifactId,
                 graph_sha256: graphSha256,
             }, "Artifact inventory")}`,

package/dist/contracts/native/nativeToolContracts.js

@@ -58,7 +58,7 @@ export const swiftSymbolsSchema = z
     .string()
     .min(1)
     .regex(/^[^\n]*$/u, "Each Swift symbol must be one line.")
-    .regex(/^[^\u0000]*$/u, "Swift symbols cannot contain NUL."))
+    .regex(/^[^\x00]*$/u, "Swift symbols cannot contain NUL."))
     .min(1);
 /** Provider-neutral semantic operations backed initially by macOS utilities. */
 export const NATIVE_TOOL_CONTRACTS = [

package/dist/contracts/sessionLifecycleInputs.js

@@ -1,16 +1,17 @@
+import { isAbsolute } from "node:path";
 import { executableFormatHintSchema } from "../domain/dosCom.js";
-import { isAbsoluteLocalPath, localPathStringSchema, } from "../domain/localPath.js";
+import { localPathStringSchema } from "../domain/localPath.js";
 import { z } from "zod";
 import { analysisProviderSelectorSchema } from "./providerSelection.js";
 /** Caller-supplied analysis snapshot path; must name its destination absolutely. */
 const snapshotPathSchema = localPathStringSchema
-    .refine(isAbsoluteLocalPath, {
+    .refine(isAbsolute, {
     message: "snapshot_path must be an absolute local filesystem path (for example /tmp/rea/analysis.json or C:\\rea\\analysis.json)",
 })
     .describe("Absolute local filesystem path for the analysis snapshot; relative paths are rejected.");
 /** Caller-supplied analysis target path; must name the target absolutely. */
 const binaryTargetPathSchema = localPathStringSchema
-    .refine(isAbsoluteLocalPath, {
+    .refine(isAbsolute, {
     message: "path must be an absolute local filesystem path (for example /tmp/fixture.bin or C:\\analysis\\fixture.bin)",
 })
     .describe("Absolute local filesystem path for the analysis target; relative paths are rejected.");

package/dist/contracts/sessionStatusContract.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
-import { isAbsoluteLocalPath, localPathStringSchema, } from "../domain/localPath.js";
+import { isAbsolute } from "node:path";
+import { localPathStringSchema } from "../domain/localPath.js";
 /** Optional expectations used to compare the live session with its caller. */
 export const binarySessionInputSchema = z.strictObject({
     expected_package_version: z.string().min(1).optional(),
@@ -8,7 +9,7 @@ export const binarySessionInputSchema = z.strictObject({
         .regex(/^[a-f0-9]{64}$/u)
         .optional(),
     expected_server_path: localPathStringSchema
-        .refine(isAbsoluteLocalPath, {
+        .refine(isAbsolute, {
         message: "expected_server_path must be an absolute local filesystem path (for example /opt/rea/dist/main.js)",
     })
         .describe("Absolute local filesystem path expected for the running server; relative paths are rejected.")

package/dist/contracts/sessionToolContracts.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
-import { isAbsoluteLocalPath, localPathStringSchema, } from "../domain/localPath.js";
+import { isAbsolute } from "node:path";
+import { localPathStringSchema } from "../domain/localPath.js";
 import { artifactComparisonInputSchema } from "../domain/artifactComparison.js";
 import { bundleComparisonInputSchema } from "../domain/bundleComparison.js";
 import { callPathInputSchema } from "../domain/callPathSchemas.js";
@@ -28,7 +29,7 @@ const session = (name, description, inputSchema) => ({
 /** Session-owned Evidence bundle export options. */
 export const exportEvidenceBundleInputSchema = z.strictObject({
     path: localPathStringSchema
-        .refine(isAbsoluteLocalPath, {
+        .refine(isAbsolute, {
         message: "path must be an absolute local filesystem path (for example /tmp/rea/evidence.json or C:\\rea\\evidence.json)",
     })
         .describe("Absolute local filesystem path for the exported evidence bundle; relative paths are rejected."),

package/dist/contracts/sessionToolSchemas.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
-import { isAbsoluteLocalPath, localPathStringSchema, } from "../domain/localPath.js";
+import { isAbsolute } from "node:path";
+import { localPathStringSchema } from "../domain/localPath.js";
 import { processTraceSpecificationSchema } from "../domain/process/processTraceSpecification.js";
 import { evidenceSchema } from "../domain/evidence.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
@@ -17,7 +18,7 @@ export const addressContextInputSchema = z.strictObject({
 /** Session-owned Evidence bundle import options. */
 export const importEvidenceBundleInputSchema = z.strictObject({
     path: localPathStringSchema
-        .refine(isAbsoluteLocalPath, {
+        .refine(isAbsolute, {
         message: "path must be an absolute local filesystem path (for example /tmp/evidence.json or C:\\rea\\evidence.json)",
     })
         .describe("Absolute local filesystem path for the evidence bundle to import; relative paths are rejected."),

package/dist/contracts/toolOutputSchemaGroups.js

@@ -115,8 +115,8 @@ export const officialOutputSchemas = {
     procedure_references: evidenceResultOf(z.object({
         procedure: procedureIdentitySchema,
         direction: z.enum(["incoming", "outgoing"]),
-        reference_kinds_available: z.boolean().optional(),
-        unresolved_calls: z.array(unresolvedCallSchema).default([]),
+        reference_kinds_available: z.boolean(),
+        unresolved_calls: z.array(unresolvedCallSchema),
         references: z.array(referenceEdgeSchema),
     })),
     procedure_pseudo_code: evidenceResultOf(nullableText),

package/dist/contracts/toolOutputSchemaPrimitives.js

@@ -405,11 +405,8 @@ export const procedureInfoOutput = evidenceResultOf(z.object({
     length: z.number().min(0),
     signature: nullableText,
     locals: z.array(localVariableSchema),
-    classification: procedureClassificationSchema.nullable().default(null),
-    body: functionBodySchema.default({
-        available: false,
-        reason: "The provider did not report complete function body ranges.",
-    }),
+    classification: procedureClassificationSchema.nullable(),
+    body: functionBodySchema,
 }));
 export const symbolDiscoveryOutput = (property) => evidenceResultOf(z.object({
     count: z.number().int().min(0),

package/dist/domain/analysisErrorBase.js

@@ -50,4 +50,9 @@ export class AnalysisError extends Error {
     executionFailure = undefined;
     partialObservation;
     cleanupReport = undefined;
+    /** Retain a completed observation when a later step fails. */
+    retainPartialObservation(observation) {
+        this.partialObservation ??= observation;
+        return this;
+    }
 }

package/dist/domain/analysisErrorPresentation.js

@@ -147,7 +147,7 @@ export const analysisErrorUserMessage = (error) => {
     if (standardMessage !== undefined)
         return standardMessage;
     if (error instanceof ArtifactOperationError)
-        return artifactMessage(error.reason);
+        return artifactMessage(error.operation, error.reason);
     if (error instanceof EvidenceReferenceError)
         return error.reason === "missing"
             ? `Evidence ${error.evidenceId} is not retained in this session. Supply complete inline Evidence, re-run its producer, or import its bundle before using this reference.`
@@ -267,7 +267,7 @@ const START_FAILURE_TAGS = new Set([
     "HopperProcessError",
     "HopperStartError",
 ]);
-const artifactMessage = (reason) => {
+const artifactMessage = (operation, reason) => {
     if (reason === "cancelled")
         return "Artifact operation was cancelled. Start it again when ready.";
     if (reason === "limit")
@@ -276,6 +276,8 @@ const artifactMessage = (reason) => {
         return "Artifact contains an unsafe or conflicting internal path. Inspect the reported path and correct the artifact before retrying.";
     if (reason === "unavailable")
         return "Artifact processing is unavailable for the current target or host. Check artifact support and required tools.";
+    if (reason === "integrity" && operation === "analyze_javascript_application")
+        return "Artifact bytes contradict declared integrity. If expected, rerun analyze_javascript_application with integrity_policy=record-and-continue (CLI: --integrity-policy record-and-continue) to retain observed bytes as untrusted; otherwise get a fresh copy.";
     if (reason === "format" || reason === "integrity")
         return "Artifact is invalid or has changed. Get a fresh copy and try again.";
     return "Artifact could not be read or written. Check file access and try again.";

package/dist/domain/analysisSnapshot.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
 import { z } from "zod";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { analysisProfileSchema, analysisProfilesEqual, committedProviderSchema, } from "./analysisProfile.js";
 import { evidenceBundleForTarget, evidenceBundleSchema, parseEvidenceBundle, } from "./evidenceBundle.js";
 import { evidenceLocationSchema, } from "./evidence.js";
@@ -288,7 +289,8 @@ export const parseAnalysisSnapshot = (input) => {
 const hasCanonicalQueryOrder = (entries) => {
     let previous;
     for (const { query_id: queryId } of entries) {
-        if (previous !== undefined && previous.localeCompare(queryId) > 0)
+        if (previous !== undefined &&
+            compareUnicodeCodePoints(previous, queryId) > 0)
             return false;
         previous = queryId;
     }

package/dist/domain/analysisView/analysisView.js

@@ -164,12 +164,10 @@ export const analysisViewResultSchema = z.discriminatedUnion("kind", [
 ]);
 /** Construct a typed input failure for one selected-view constraint. */
 export const analysisViewInputError = (issues) => new AnalysisInputError(INSPECT_ANALYSIS_VIEW_OPERATION, undefined, issues);
-/** SHA-256 of the canonical projected JSON, excluding this digest field. */
-export const analysisViewDigest = (projection) => digestCanonicalValue(projection, "Analysis view");
 /** Attach the content digest that must change when projected bytes change. */
 export const sealAnalysisView = (projection) => analysisViewResultSchema.parse({
     ...projection,
-    view_digest: analysisViewDigest(projection),
+    view_digest: digestCanonicalValue(projection, "Analysis view"),
 });
 const parentDigest = (evidenceId) => evidenceId.slice(3);
 const parseJavaScriptParent = (input) => {

package/dist/domain/android/androidPartialObservation.js

@@ -0,0 +1,36 @@
+import { z } from "zod";
+import { digestSchema } from "../digests.js";
+import { jsonObjectSchema, jsonValueSchema } from "../jsonValue.js";
+import { localPathStringSchema } from "../localPath.js";
+const operationSchema = z.enum([
+    "inspect_android_package",
+    "search_android_classes",
+    "inspect_android_class",
+    "inspect_android_method",
+    "trace_android_references",
+]);
+/** JSON-safe Android provider facts collected before an analysis failure. */
+export const androidPartialObservationSchema = z.strictObject({
+    provider_id: z.literal("jadx"),
+    operation: operationSchema,
+    target: z.strictObject({
+        selected_path: localPathStringSchema,
+        path: localPathStringSchema,
+        sha256: digestSchema,
+        format: z.literal("apk"),
+    }),
+    provider_facts: z.strictObject({
+        jar_sha256: digestSchema.nullable(),
+        bridge_sha256: digestSchema.nullable(),
+        bridge_name: z.string().min(1),
+        bridge_version: z.string().min(1),
+        server_name: z.string().nullable(),
+        server_version: z.string().nullable(),
+        engine_version: z.string().min(1).nullable(),
+    }),
+    calls: z.array(z.strictObject({
+        operation: z.string().min(1),
+        input: jsonObjectSchema,
+        response: jsonValueSchema,
+    })),
+});

package/dist/domain/apple/dylibResolution.js

@@ -8,7 +8,7 @@ import { DYLIB_RESOLUTION_LIMITATIONS, deriveFindings, } from "./dylibResolution
  * `/`, none of them `.` or `..`, without backslash or NUL. Advertised schema
  * patterns avoid look-around, which RE2 and Rust validators reject.
  */
-const ROOT_RELATIVE_PATH = /^(?:[^\x2f\\\u0000.][^\x2f\\\u0000]*|\.[^\x2f\\\u0000.][^\x2f\\\u0000]*|\.\.[^\x2f\\\u0000]+)(?:\x2f(?:[^\x2f\\\u0000.][^\x2f\\\u0000]*|\.[^\x2f\\\u0000.][^\x2f\\\u0000]*|\.\.[^\x2f\\\u0000]+))*$/u;
+const ROOT_RELATIVE_PATH = /^(?:[^\x2f\\\x00.][^\x2f\\\x00]*|\.[^\x2f\\\x00.][^\x2f\\\x00]*|\.\.[^\x2f\\\x00]+)(?:\x2f(?:[^\x2f\\\x00.][^\x2f\\\x00]*|\.[^\x2f\\\x00.][^\x2f\\\x00]*|\.\.[^\x2f\\\x00]+))*$/u;
 const rootRelativePathSchema = z
     .string()
     .min(1)

package/dist/domain/artifactComparison.js

@@ -1,4 +1,4 @@
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { compareUnicodeCodePoints } from "./unicodeCodePointOrder.js";
 import { z } from "zod";
 import {} from "./artifactGraph.js";
 import { evidenceSchema } from "./evidence.js";
@@ -112,7 +112,7 @@ export const compareArtifacts = (leftEvidence, rightEvidence) => {
         right_manifest_id: right.inventory.manifest.manifest_id,
         summary,
         changes,
-        limitations: [...new Set(limitations)].sort(compareCodePoints),
+        limitations: [...new Set(limitations)].sort(compareUnicodeCodePoints),
     });
 };
 const compareOccurrences = (left, right, evidenceLinks, complete) => {
@@ -124,7 +124,7 @@ const compareOccurrences = (left, right, evidenceLinks, complete) => {
     const rightRelations = relationsByPath(right);
     const paths = [
         ...new Set([...leftByPath.keys(), ...rightByPath.keys()]),
-    ].sort(compareCodePoints);
+    ].sort(compareUnicodeCodePoints);
     const output = [];
     for (const path of paths) {
         const leftOccurrence = leftByPath.get(path);
@@ -271,7 +271,7 @@ const relationsByPath = (inventory) => {
             values.push(projection);
     }
     for (const values of output.values())
-        values.sort((left, right) => compareCodePoints(canonicalJson(left), canonicalJson(right)));
+        values.sort((left, right) => compareUnicodeCodePoints(canonicalJson(left), canonicalJson(right)));
     return output;
 };
 const summarize = (left, right, changes, covered) => {

package/dist/domain/artifactGraph.js

@@ -121,7 +121,7 @@ const artifactOccurrenceSchema = z.object({
     limitations: z.array(z.string()),
 });
 /** Observed bytes that contradict a container's declared integrity identity. */
-const integrityContradictionSchema = z.object({
+export const integrityContradictionSchema = z.object({
     contradiction_id: contradictionIdSchema,
     occurrence_id: occurrenceIdSchema,
     parent_artifact_id: artifactIdSchema,

package/dist/domain/artifactIdentity.js

@@ -1,29 +1,29 @@
-import { canonicalDigest } from "./comparisonSemantics.js";
+import { digestCanonicalValue } from "./canonicalDigest.js";
 /** Content-address an artifact independently of where it was observed. */
-export const artifactIdForContent = (sha256) => `art_${canonicalDigest({ sha256 }, "Artifact")}`;
+export const artifactIdForContent = (sha256) => `art_${digestCanonicalValue({ sha256 }, "Artifact")}`;
 /** Identify an occurrence by its root and exact logical location. */
 export const occurrenceIdForLocation = (input) => input.logicalPath === "."
-    ? `occ_${canonicalDigest({ root: input.rootArtifactId }, "Artifact")}`
-    : `occ_${canonicalDigest({
+    ? `occ_${digestCanonicalValue({ root: input.rootArtifactId }, "Artifact")}`
+    : `occ_${digestCanonicalValue({
         root_artifact_id: input.rootArtifactId,
         logical_path: input.logicalPath,
         entry_kind: input.entryKind,
     }, "Artifact")}`;
 /** Commit to graph members in the ordering established by the inventory owner. */
-export const artifactGraphDigest = (input) => canonicalDigest({
+export const artifactGraphDigest = (input) => digestCanonicalValue({
     nodes: input.nodes,
     occurrences: input.occurrences,
     edges: input.edges,
     integrity_contradictions: input.contradictions,
 }, "Artifact");
 /** Bind a root artifact to its graph commitment. */
-export const artifactManifestId = (rootArtifactId, graphSha256) => `agm_${canonicalDigest({ root_artifact_id: rootArtifactId, graph_sha256: graphSha256 }, "Artifact")}`;
+export const artifactManifestId = (rootArtifactId, graphSha256) => `agm_${digestCanonicalValue({ root_artifact_id: rootArtifactId, graph_sha256: graphSha256 }, "Artifact")}`;
 /** Identify one integrity disagreement at its observed logical path. */
-export const artifactContradictionId = (input) => `ic_${canonicalDigest({
+export const artifactContradictionId = (input) => `ic_${digestCanonicalValue({
     root_artifact_id: input.rootArtifactId,
     logical_path: input.logicalPath,
     declared_sha256: input.declaredSha256,
     observed_sha256: input.observedSha256,
 }, "Artifact")}`;
 /** Identify an edge by its semantic relationship and exact occurrence. */
-export const artifactEdgeId = (semantic) => `edge_${canonicalDigest(semantic, "Artifact")}`;
+export const artifactEdgeId = (semantic) => `edge_${digestCanonicalValue(semantic, "Artifact")}`;